15

I need to connect to a host with a dynamic IP address.

Every time its IP changes, SSH prompts me the fingerprint validation thing:

The authenticity of host '...' can't be established.
RSA key fingerprint is ....
Are you sure you want to continue connecting (yes/no)?

Would it be possible to pass SSH the host public key, so that:

  1. SSH validates the host's authenticity automatically
  2. The host key is not stored in the known_hosts file

This question differs from How can I avoid SSH's host verification for known hosts? since that other questions aims to suppress SSH validation, while I do not want to suppress it: I do want to have the host authenticated, just using the host's public key (which I know, and have it stored in a file) rather than SSH known_hosts file.

To me the other question seems to be about connecting to a different server every time, rather than connecting to a single well-known server with a dynamic IP.

0

2 Answers 2

10

The best solution (ie. closest to what I want) I could find is to use the option HostKeyAlias: it will use an hostname I specify to access known_hosts (rather than the IP I'm connecting to).

I will need to add the host's public key to known_hosts using a given hostname (eg: myhost) and then connect to it using:

ssh -o 'HostKeyAlias myhost' ...
2
  • I know it's been a while, but: if this best answers your question, please accept it. Jul 27, 2015 at 13:38
  • Note for others: you can add the HostKeyAlias config value to your ~/.ssh/config file or even to the global /etc/ssh/ssh_config file.
    – kael
    Feb 14, 2018 at 19:19
9

The known_hosts file is not just the key, it also contains the hostname you use to connect, and if possible the IP that corresponds. Which is why you see the error, it is comparing the triplet it gets from the server with what you stored in the known_hosts file.

So, if the IP keeps changing, you could disable CheckHostIP and that means it will just check the hostname and host key. If those remain unaltered, you should have less complaints, but you will be at risk if someone hijacks your DNS.

3
  • 1
    Thanks for the answer, I'll test it asap! Why would it be at rist anyway? If I know a host's SSH public key, that should be enough to be totally safe in any case (unless somebody manages to steal that host's private key), shouldn't it?
    – peoro
    Jun 8, 2013 at 15:33
  • And still I don't really like it if I have to be honest. Using that flag SSH will still access known_hosts. Why? Cannot I say "ssh connect to X whose public key is Y"? Why not? Wouldn't that be 100% sure.
    – peoro
    Jun 8, 2013 at 15:41
  • The idea is that the host key is part of a larger whole, and that alone is not enough guarantee to be sure the server you are connecting to is still the one you connected to earlier. You need to be sure the IP, and DNS entries match as well.. remember, this is a network based shell, so the network needs to be checked as well.
    – NickW
    Jun 10, 2013 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .